Function TestVirtualProtect

Self-Remapping Code/main.cpp:52–109

Verify that we're unable set .text or .rdata's page protection via NtProtectVirtualMemory. e.g., changing .text from PAGE_EXECUTE_READ to PAGE_EXECUTE_READWRITE should fail after remap::RemapSelfImage returns.

// e.g., changing .text from PAGE_EXECUTE_READ to PAGE_EXECUTE_READWRITE should
// fail after remap::RemapSelfImage returns.
static void TestVirtualProtect(const PVOID ImageBase)
{
    PE_HEADER pe;
    if (!FillPEHeader(SIZE_T(ImageBase), pe))
        return;

    const PIMAGE_SECTION_HEADER text = GetPeSectionByName(pe, ".text");
    const PIMAGE_SECTION_HEADER rdata = GetPeSectionByName(pe, ".rdata");
    if (!(text && text < rdata))
        return;

    auto testVirtualProtect = [](SIZE_T BaseAddress, SIZE_T RegionSize, DWORD NewProtection)
    {
        PVOID regionBase = PVOID(BaseAddress);
        SIZE_T regionSize = RegionSize;
        DWORD oldProtection = 0;
        ntapi::NTSTATUS status = ntapi::NtProtectVirtualMemory(GetCurrentProcess(),
                                                               &regionBase,
                                                               &regionSize,
                                                               NewProtection,
                                                               &oldProtection);
        if (status != ntapi::STATUS_INVALID_PAGE_PROTECTION &&
            NewProtection != oldProtection)
                printf("Unexpected NtProtectVirtualMemory status for %p (%X):  0x%08X\n",
                       BaseAddress,
                       NewProtection,
                       status);
    };

    const std::array<DWORD, 12> protectionValues =
    {
        PAGE_NOACCESS,
        PAGE_READONLY,
        PAGE_READWRITE,
        PAGE_WRITECOPY,
        PAGE_EXECUTE,
        PAGE_EXECUTE_READ,
        PAGE_EXECUTE_READWRITE,
        PAGE_EXECUTE_WRITECOPY,
        PAGE_GUARD,
        PAGE_NOCACHE,
        PAGE_WRITECOMBINE,
        PAGE_REVERT_TO_FILE_MAP
    };

    for (auto protection : protectionValues)
    {
        // .text
        testVirtualProtect(pe.optionalHeader->ImageBase,
                           PE_HEADER_SIZE + text->Misc.VirtualSize,
                           protection);

        // .rdata
        testVirtualProtect(pe.optionalHeader->ImageBase + rdata->VirtualAddress,
                           rdata->Misc.VirtualSize,
                           protection);
    }
}